I don't think it's a php specific bug, php read the cookie via apache 
apr_table_get

 
apr_table_get return ", a=1" in your case.

oh, ignore my previous comment, apache return a comma separated string if there is 
multi cookie headers

Thank you very much to help me solve the problem in such a short time. Do you know why the browser will send the cookie header? Our website every day will receive nearly 10,000 such requests.

Now if the cookie name has a comma ,It becomes 2 cookie name

<?php
$fp = fsockopen("localhost", 50080, $errno, $errstr, 30);
if (!$fp) {
    echo "$errstr ($errno)<br />\n";
} else {
    $out = "GET /show_cookie.php HTTP/1.1\r\n";
    $out .= "Host: localhost:50080\r\n";
//    $out .= "Cookie:\r\n";
    $out .= "Cookie: a=1; b=2; c,d=abc\r\n";
    $out .= "Connection: Close\r\n\r\n";
    fwrite($fp, $out);
    while (!feof($fp)) {
        echo fgets($fp, 128);
    }
    fclose($fp);
}



----------------------------
Array
(
    [a] => 1
    [b] => 2
    [c] => 
    [d] => abc
)

I have no idea why some browser will do this, but I can not find a proof that 
doesn't allow this.

anyway, this fix will introduce bc break, like, before,

cookie: userids=123,1232,123213;

I saw such usage before, so... I didn't commit this.  I will try to find some 
fix in the apache apis

RFC2616 says : Multiple message-header fields with the same field-name MAY be 
present in a message if and only if the entire field-value for that header field 
is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to 
combine the multiple header fields into one "field-name: field-value" pair, 
without changing the semantics of the message, by appending each subsequent 
field-value to the first, each separated by a comma. The order in which header 
fields with the same field-name are received is therefore significant to the 
interpretation of the combined field value, and thus a proxy MUST NOT change the 
order of these field values when a message is forwarded.

@pierrick, thanks,  I also found a page:  
http://kristol.org/cookie/errata.html   ;)

RFC6265 is the last specification for HTTP State Management Mechanism.

Section 4.2.1 says that the grammar for the Cookie header is 

   cookie-header = "Cookie:" OWS cookie-string OWS
   cookie-string = cookie-pair *( ";" SP cookie-pair )

Since RFC2626 (HTTP) only allows multiple message-header fields with the same if and only if the entire field-value for 
that header field is defined as a comma-separated list, I guess having multiple Cookie: header is not a valid case.

@pierrick , thanks for the explaination, and after some search, I also reached 
that we can not fix this without any side-affect(BC break),

so, I think maybe won't fix. 

thanks

as we discussed before,closed.

maybe you can file a bug to apache, it should not accept two cookies since they 
can not be combined